Security Weekly Podcast Network (Audio)

Mr. Data, Joomla Babooa, 1VPNS, RabbitMQ, UEFI, Center 16, Sextortion, Aaran Leyland, and More on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-598

While LLMs and agents are new to appsec and everyone else, a lot of AI security requirements translate to well-known API security requirements. Jeremy Snyder helps us frame the OWASP LLM Top 10 into five layers in order to help orgs understand and prioritize their attack surface. A lot of orgs don't have to deal with model-specific threats or building their own GPU architecture, but every org adopting LLMs and agents should be aware of how those agents are being invoked and the output those agents are producing. That awareness of input and output helps in identifying and mitigating prompt injection attacks, ensuring agents are working within their expected boundaries, and taming token budgets.

Resources:

• https://genai.owasp.org/llm-top-10/
• https://github.com/rtk-ai/rtk
• https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-caching.html
• https://www.firetail.ai/blog/beyond-the-spectacle-rsac-2026-and-the-5-layers-of-ai-security

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-391

Software Supply Chain Security: Build Pipeline (CI/CD) Exploitation

Boost Security is the creator of some very popular build pipeline security tools, like Bagel and Poutine. Today, we discuss their latest tool, Smoked Meat. They describe it as "Like Metasploit, but for CI/CD pipelines".

Segment Resources:

• Smoked Meat announcement
• Smoked Meat github
• Smoked Meat demo with Guillaume and François

The Three Identity Problem: Surviving Identity Security's Chaotic Era

Identity security has entered its chaotic era. Human, non-human, and agentic AI identities no longer just coexist. They form an uncontrolled inheritance chain in which a human creates an agent, the agent spins up service principals, OAuth grants, and role assignments, and that whole chain keeps running long after the human changes roles or leaves. Most of these chains are being spawned by business users on low-code and enterprise AI platforms, outside traditional identity controls and largely invisible to security.

In this segment, Radiant Logic CEO Dr. John Pritchard joins us to unpack why this is no longer a visibility problem. It is an observability problem. And it is shifting the center of gravity in identity security from authentication to authorization. Listeners will leave with a clearer view of where their current IAM, IGA, and NHI programs fall short, and a practical lens for governing the rapidly expanding population of AI agents already inside their environments.

To go deeper on what John discussed today, watch Radiant Logic's on-demand webinar Identities Under Attack: How Adversaries Exploit the Human-Machine-Agent Divide at https://securityweekly.com/radiantlogicidv.

Everyone Wants an AI Assistant. Few Are Ready to Govern One

Explore a growing reality many professionals can relate to: the appeal of using AI agents to handle the work that keeps piling up - from inbox management to research and logistics - and the governance challenges that quickly follow. The real barrier to scaling personal or enterprise AI agents isn’t the technology itself, but defining clear roles, access boundaries, oversight, and lifecycle management. As organizations deploy more autonomous AI agents, the same identity frameworks used to govern workforce and non-employee identities must now evolve to manage AI-driven access before scale and risk outpace control.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

From Sales Engineer to Forward Deployed Engineer: The Rise of Hybrid Technical Roles

As technology organizations evolve, technical roles are becoming increasingly fluid - particularly at the intersection of product, engineering, and customer success. This conversation explores what it means to be a modern sales engineer and how the role is increasingly expanding into responsibilities often associated with forward deployed engineers: translating complex technical capabilities into real-world outcomes, solving customer challenges in real time, and serving as a critical bridge between product teams and end users. At the center of this evolution is a customer-first mindset - one that prioritizes listening, adaptability, and long-term partnership. As organizations race to innovate, the companies that stand out will be those that remain deeply focused on customer needs while empowering technical teams to operate beyond traditional role boundaries.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Stop Identity Fraud: Modern Strategies for Insurance and Healthcare

Identity fraud is growing more sophisticated across both insurance and healthcare, making identity management a critical line of defense. In this executive interview, Kim Brown, VP of Product Management, will explore how organizations can strengthen identity verification, authentication, and risk assessment to reduce fraud while improving user experiences. The discussion will highlight emerging threats, evolving regulatory expectations, and practical strategies for deploying identity solutions at scale. Attendees will gain actionable insights to protect customers, patients, and their organizations without adding friction.

This segment is sponsored by LexisNexis Risk Solutions. Visit https://securityweekly.com/lexisnexisidv to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-467

Borg, GitLost, ColdFusion, GodDamn, GhostApproval, OWA, Epaphroditus, Locutus, Josh Marpet, and More on this episode of the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-597

In the security news:

• Son of Anton strikes again!
• HalluSquatting and using Claude to defend itself
• CISA KEV’s Revolving Door
• LLM's hallucinate and companies get sued
• Additionally - GitLost
• Yet even more Linux vulnerabilities
• Citrix just keeps bleeding
• Old hardware is new again
• A sneak peak into next week's tech segment
• Tenda hidden backdoors
• We're still talking about Mirai
• Today was not a good day for Roundcube
• Canada is hacking criminals
• AI safeguards are still annnoying
• All cars will spy on you
• The FatFs unpatched vulnerability in millions of embedded devices
• Windows OS market share drops below 60% (Paul uses Arch)
• ‘We Cannot Choose to Become Idiots’ - or can we?

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-934

The latest generation of AI models has collapsed the time from vulnerability discovery to weaponized exploit from weeks to minutes, and reactive, module-based tools built around static dashboards simply can't keep up.

In this episode, Tanium COO Matt Quinn joins Business Security Weekly to discuss Tanium Atlas, the new autonomous operating system for IT and security. Matt explains why "good enough" operations are now a liability, how Atlas turns a single operator into the equivalent of an entire team, giving organizations the speed, scale, and efficiency to match the pace of today's threat environment. He also breaks down why nearly two decades of real-time endpoint telemetry across more than 36 million endpoints is the foundation no AI model can replicate on its own.

This segment is sponsored by Tanium. Visit https://securityweekly.com/tanium to learn more about them!

In the leadership and communications segment, CEOs, CIOs clash over AI’s value, Aspiring Leaders, Don’t Just Network Up, Your Talent Strategy Has to Keep Up with Your AI Transformation, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw-455

Dune References, FAT, Claude, ZhiPu, PolinRider, RentaBot, Sony, Aaran Leyland, and More on the Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-596

Mobile applications have unique risks and threat models compared to server-side applications and infrastructure. Consequently, they need different strategies to ensure their business logic and workflows well secured. We'll dive into some of these defense-in-depth strategies and why they are important to mobile applications. Securing workflows goes beyond input validation and pattern matching suspicious payloads; it requires detailed attention to state machines, edge cases, and collecting signals to evaluate trust.

Segment Resources:

• https://hubs.la/Q04jLKj70
• https://mas.owasp.org/MASTG/0x04c-Tampering-and-Reverse-Engineering/
• https://owasp.org/API-Security/editions/2023/en/0x00-header/

This segment is sponsored by Guardsquare. Visit https://securityweekly.com/guardsquare to learn more about them!

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-390

In this week's interview, we kick off the conversation with how Sonrai's expertise in securing cloud identity permissions had the company well placed to address the explosion of AI agents and the clear risks they represented. On the surface, this looks like a cloud/hyperscaler permissions challenge, but it isn't that simple. As agents like Claude Code, Codex, and Hermes are connected to enterprise cloud agents, the risk spreads outside VPCs and onto endpoints.

Check out the episode to learn more about some of the most common risks Sandy finds and how Sonrai goes about addressing them.

This segment is sponsored by Sonrai Security. Visit https://securityweekly.com/sonrai to learn more about them!

Segment Resources

• AWS Bedrock agent permissions: what you need to lock down before you go live

Organizations looking to unlock the power of Enterprise AI Agents, and in a controlled and safe way at the speed of AI. Identity is at the heart of it. However, NHI Governance Is Not Enough for Enterprise AI Agents.

The identity industry has responded to the rise of AI agents the same way it responds to every new identity challenge: extend existing frameworks. Map agents to human owners. Enforce least privilege. Govern them like non-human identities.

It is a reasonable instinct. It is also insufficient in ways that matter enormously. Non-human identity security was built for a deterministic world - service accounts, API keys, bots. These identities do what they are configured to do. Their behavior is predictable enough that static governance models work. Enterprise AI agents are categorically different. Not in degree - in kind. They don't execute fixed instructions. They reason, plan, and adapt in response to context. Their scope shifts with every task. Their behavior at runtime can diverge significantly from anything true at provisioning time. Unlike any identity that came before them, they frequently change their intent, at a pace no governance model built for human movers or machine credentials was designed to handle.

Wrapping them in the same framework you use for a service account isn't wrong. It's just insufficient in precisely the places where risk accumulates.

• Download the SANS AI Security Maturity Model eBook

This segment is sponsored by aizome. Visit https://securityweekly.com/aizomeidv to learn more about them!

A self-driving car still has a license plate The accountability didn't change just because the driver did. The same has to be true for AI agents, but most environments can't trace an agent action back through the layers of delegation to the human who authorized it. Howard Ting, CEO of Opal Security, joins Security Weekly to discuss what the accountability model looks like when employees run swarms of agents, and what has to be in place before that accountability chain is tested.

• https://www.opal.dev/resource-center/identity-governance-report-2026-ai-access

This segment is sponsored by Opal Security. Visit https://securityweekly.com/opalidv to learn more about them!

Organizations have invested heavily in identity platforms, but many still struggle to maximize security, efficiency, and governance outcomes. As AI transforms both cyber defense and cyber threats, Identity Security is emerging as a critical foundation for securing human and non-human identities alike. In this discussion, we explore how AI is helping organizations reduce costs, improve operations, defend against AI-powered attacks, and address the governance challenges created by AI agents—highlighting the convergence of Identity Security, AI Security, and AI Governance.

This segment is sponsored by SDG. Visit https://securityweekly.com/sdgidv to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-466

I talk to Gibb Witham, President of Hack The Box, about cyber readiness, hands-on security training, Hack The Box, and AI in cybersecurity.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn-595